Privacy Policy

DidWork verifies whether an outcome your software reported actually happened. To do that it holds your account, read-only credentials for the systems it checks, and a record of each check. This page says exactly what that means.

Last updated 17 September 2026.

What we store

When you sign in with GitHub we store your GitHub numeric id, your login, and your display name. If you sign in by email link instead, we store that email address. We do not receive or store your GitHub password, and we never ask for one.

Alongside that: your API keys (hashed, so we cannot read them back), your provider connections, your verifications, your watches, any passkeys you register, and a security activity log.

Your provider credentials

When you connect Stripe, GitHub, GitLab, Linear, Jira, Sentry, Slack or Resend, the token you paste is encrypted at rest with AES-256-GCM. After you submit it, the console only ever shows you a last-4 hint. It is never displayed again and never sent to your browser.

DidWork asks for read-only scopes and nothing more. It is built to observe outcomes, not to cause them, so it never needs write access to any account you connect.

Verifications and evidence

Each verification stores three things separately: the claim your software made, the evidence DidWork gathered, and the verdict.

Evidence can contain data about your own customers. If you verify a Stripe refund, the evidence holds that payment's amount and status. If you verify an email delivery, it holds that recipient's delivery state. For that data you are the controller and DidWork is a processor acting on your instruction, which is the claim you sent.

Receipts

A receipt is a public link to a single verification. It is signed, expires after 30 days, and carries noindex so search engines skip it. Within those 30 days, anyone holding the link can see that claim, its evidence and its verdict without signing in.

That is the point of a receipt, and it is worth knowing before you paste one into a public pull request. It dies sooner if retention deletes the underlying evidence first.

Who else sees it

Webfonts are served from didwork.sh, not from a font CDN, so loading a page does not disclose your IP to a third party.

How long we keep it

Evidence deletion is real deletion. There is no archive and no restore, so something verified today cannot be produced as proof after its window closes. Capture verifications with a webhook if you need them to outlive it.

Cookies

No advertising or third-party tracking cookies. The ones we set are: dw_session (your signed session, HttpOnly), dw_in (a non-sensitive flag so the marketing pages can say "Console" instead of "Get a free key"), dw_mfa (a passkey step in progress), dw_flash (a one-time status message), and dw_new. Cloudflare Turnstile sets its own cookie on the email sign-in form to tell humans from bots.

Getting it deleted

Delete your account from the bottom of the console overview. It removes your API keys, every stored provider credential, your verifications and their evidence, your watches, your passkeys and your account row, and cancels an active Pro subscription first. It is immediate and cannot be undone.

Two things deliberately survive it. Your security activity log is kept as a security record with its IP address and username stripped out, then deleted on the normal 365-day schedule. Your Stripe customer record is kept, because the invoices under it are accounting records.

You can also remove pieces individually: revoke a key, disconnect a provider, stop a watch, or remove a passkey. To opt out of the weekly digest, use the unsubscribe link in it.

Contact

Privacy questions and erasure requests: hello@didwork.sh.